bff-entry-points
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides high-quality architectural guidance for building secure HTTP and realtime entry points, adhering to IETF and OWASP standards.
- [SAFE]: It implements a 'deny-by-default' strategy via a prepared registrar, preventing unclassified route exposure.
- [SAFE]: It handles session security correctly by using HttpOnly, Secure, SameSite=Strict cookies with __Host- prefixes to keep tokens server-side.
- [EXTERNAL_DOWNLOADS]: The skill mentions standard libraries such as @hono/zod-openapi and @fastify/websocket; these are well-known, industry-standard packages appropriate for the described architecture.
- [INDIRECT_PROMPT_INJECTION]: The instructions describe the ingestion of browser-supplied data (headers, body, parameters) but mitigate risks through mandatory strict schema validation and service-layer authorization using provider-free principals.
- [COMMAND_EXECUTION]: No evidence of arbitrary shell commands, unsafe system calls, or dangerous subprocess execution was found in the skill or its references.
Audit Metadata